remove api keys from route into config

orly?